5 ms·

We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider

We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head. Netnod.se uses a DNSKEY that is too small on their main domain. Rcodezero.at might indeed be something. Thanks. We donate to deSEC, so it’s not free for us.

traceroute66 13d ago
> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se https://internet.nl/site/netnod.se
- Stitch4223 13d ago
  Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176
  - traceroute66 12d ago
    Super, thanks. zonemaster added to my bookmarks !
    - pawal 12d ago
      Also have a look at gonemaster, the modern replacement: https://gonemaster.evilbit.de/ https://gonemaster.evilbit.de/

traceroute66 13d ago

> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se https://internet.nl/site/netnod.se

Stitch4223 13d ago
Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176
- traceroute66 12d ago
  Super, thanks. zonemaster added to my bookmarks !
  - pawal 12d ago
    Also have a look at gonemaster, the modern replacement: https://gonemaster.evilbit.de/ https://gonemaster.evilbit.de/